A fitness tracking app collects the user's location data to map their running routes. The app also shares this data with third-party advertisers. The privacy officer is concerned about the implicit data collection and the potential for misuse of location data. Which of the following is the most appropriate mitigation?

Encrypt the location data before storing it on the device.

Collect location data only when the app is in the foreground.

Anonymize the location data before sharing it with third parties.

Provide a clear and prominent opt-in consent mechanism that explains exactly what data is collected, how it is used, and who it is shared with.

What is a common client-side threat that tricks a user's browser into making an unwanted request?

Cross-site request forgery (CSRF)

Which security threat is particularly relevant to client-server architecture?

Difficulty in enforcing consistent security policies

Inability to scale to support many users

Lack of a central point for security monitoring

Denial of service (DoS) attacks against the central server

A company is migrating its legacy two-tier application to a three-tier architecture (web, application, database). The security architect is defining the security controls for each tier. The web tier is internet-facing and handles user input. The application tier contains business logic. The database tier stores sensitive data. Which of the following is the most important control to implement at the web tier?

Encrypting all data at rest in the database.

Database activity monitoring to detect unauthorized queries.

Strict firewall rules to block all inbound traffic except on port 443.

Input validation and output encoding to prevent injection and XSS attacks.

In a mesh network security architecture, which characteristic is most essential for maintaining secure communication between nodes?

Peer-to-peer mutual authentication and encrypted links between neighboring nodes

A single shared encryption key used by all nodes to simplify key management

A central authentication server that mediates all node-to-node traffic

A hardware firewall at the network perimeter that filters all incoming and outgoing packets

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 13)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 61–65

61application · medium
A fitness tracking app collects the user's location data to map their running routes. The app also shares this data with third-party advertisers. The privacy officer is concerned about the implicit data collection and the potential for misuse of location data. Which of the following is the most appropriate mitigation?
Select an answer first
62foundation · easy
What is a common client-side threat that tricks a user's browser into making an unwanted request?
Select an answer first
63foundation · easy
Which security threat is particularly relevant to client-server architecture?
Select an answer first
64application · medium
A company is migrating its legacy two-tier application to a three-tier architecture (web, application, database). The security architect is defining the security controls for each tier. The web tier is internet-facing and handles user input. The application tier contains business logic. The database tier stores sensitive data. Which of the following is the most important control to implement at the web tier?
Select an answer first
65foundation · easy
In a mesh network security architecture, which characteristic is most essential for maintaining secure communication between nodes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Define the Security Architecture CSSLP Practice Questions (Page 13)

Questions 61–65

What is a common client-side threat that tricks a user's browser into making an unwanted request?

Which security threat is particularly relevant to client-server architecture?

In a mesh network security architecture, which characteristic is most essential for maintaining secure communication between nodes?

Keep studying — Secure Software Architecture and Design